auth-methods change-state
Command: boundary auth-methods change-state
The auth-methods change-state
command changes the active and visibility state
of an OIDC-type auth method given its ID.
An OIDC auth method can be in one of several different states: Inactive, Active Private, and Active Public. The current state of an OIDC auth method affects how endpoints respond to requests and, sometimes, whether access to an endpoint requires authentication.
- MakeInactive transitions an OIDC auth method from either the Active Private or the Active Public state into the Inactive state.
- MakePrivate transitions an OIDC auth method from either the Inactive or the Active Public state into the Active Private state. If the transition is from the Inactive state, it will only succeed if the configuration is valid.
- MakePublic transitions an OIDC auth method from either the Inactive or the Active Private state into the Active Public state. If the transition is from the Inactive state, it will only succeed if the configuration is valid.
Before you change the state of an auth-method, Boundary retrieves the provider’s discovery document for the auth method’s issuer and attempts to validate the auth-method’s configuration against this published information. If Boundary is unable to validate the configuration, an error is returned and the state change is not successful.
Examples
The following example changes the OIDC auth method's state to active-public
:
Example output:
Usage
Command options
-id
(string: "")
- The ID of the oidc-type auth method on which to operate.
OIDC auth method options
-disable-discovered-config-validation
- Disables validating the given auth method against configuration from the authorization server's discovery URL. You must specify this value every time an auth method that cannot be validated is updated or state changed. Not specifying a value is equivalent to setting the value tofalse
. The default isfalse
.-state
(string: "")
- The desired operational state of the auth method. Three different states exist for an authentication method:inactive
users can not authenticate with inactive auth methods and the inactive auth methods are not listed for unauthenticated users.active-private
users can authenticate with active-private auth methods and active-private auth methods are not listed for unauthenticated users.active-public
users can authenticate with active-public auth methods and active-public auth methods are listed for unauthenticated users.
If you change an auth method from active-public
or active-private
to inactive
, all
in-flight authentications will succeed unless the auth method’s configuration is
modified while the request is in-flight.
When you change an auth method's state using boundary auth-methods change-state
,
Boundary uses the -disable-discovered-config-validation
flag to disable validation
against the provider’s published discovery document. This allows for the very
rare occurrence when the Provider has published an invalid discovery document.
CLI options
In addition to the command specific options, there are options common to all CLI commands and subcommands: